From patchwork Wed Dec 20 17:34:19 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ido Schimmel X-Patchwork-Id: 851564 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=Mellanox.com header.i=@Mellanox.com header.b="kNLfQ43J"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3z222y0SX3z9s7f for ; Thu, 21 Dec 2017 04:34:49 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755685AbdLTRer (ORCPT ); Wed, 20 Dec 2017 12:34:47 -0500 Received: from mail-eopbgr30044.outbound.protection.outlook.com ([40.107.3.44]:2624 "EHLO EUR03-AM5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755060AbdLTReq (ORCPT ); Wed, 20 Dec 2017 12:34:46 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Mellanox.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=fktZch9PSJrsXg79UvMGzxKmq+QjaicOwmnQMKbrlHw=; b=kNLfQ43JhHtT+rrnEMZ+oDMAsPFb4twDr2dsqptCvr/A3IG72tMbn12fr0bI/6i0KaRmIjmTRxkRoMyKXXejxoExcdmmmDxJpgANLVUosoZmYlAzAXZ/am0WWQunc1+xwCFMztw+JS5F2XvHuol0ZTHDr8yJqy+ZSO5lH8z7uTQ= Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=idosch@mellanox.com; Received: from splinter.mtl.com (193.47.165.251) by HE1PR0501MB2011.eurprd05.prod.outlook.com (2603:10a6:3:35::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.302.9; Wed, 20 Dec 2017 17:34:40 +0000 From: Ido Schimmel To: netdev@vger.kernel.org Cc: davem@davemloft.net, alexander.h.duyck@intel.com, dsahern@gmail.com, fengguang.wu@intel.com, mlxsw@mellanox.com, Ido Schimmel Subject: [PATCH net v3] ipv4: Fix use-after-free when flushing FIB tables Date: Wed, 20 Dec 2017 19:34:19 +0200 Message-Id: <20171220173419.11259-1-idosch@mellanox.com> X-Mailer: git-send-email 2.14.3 MIME-Version: 1.0 X-Originating-IP: [193.47.165.251] X-ClientProxiedBy: AM5PR0502CA0023.eurprd05.prod.outlook.com (2603:10a6:203:91::33) To HE1PR0501MB2011.eurprd05.prod.outlook.com (2603:10a6:3:35::13) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 103d56c7-4848-4042-3d52-08d547cff3a0 X-Microsoft-Antispam: UriScan:; BCL:0; PCL:0; RULEID:(48565401081)(5600026)(4604075)(4534020)(4602075)(4627115)(201703031133081)(201702281549075)(2017052603307)(7153060); SRVR:HE1PR0501MB2011; X-Microsoft-Exchange-Diagnostics: 1; HE1PR0501MB2011; 3:gb1K6Kyg+9+ZU06kZ5MCkDQkw4dWbTOG3ZuwuGW0hZeXaYpoWHWQi0seW7Kk5fcgMIxAfhJCP9vpVUVtP0L2/vvGCKA8ms5gjBsbBH0jRINMAZAAphWgRlltdsczYxONIL5Yux+1NaYFVJvUen/WdCC1nAkmK0qvnqAkOhwy3AycsrVC5QwCaMvy/h7KfHgQ82pVjB2yIx9U5xs8JNHI8PM8AF/LloFP34LfLMNFNOT9ErjWHE+emZ/NEJwwQHXc; 25:lfVXxtow9Dkdxc9JIaXqaTA/QUiSalF7cQyP0Xo5cRmX9AOjboM/Es8PIhx1myLH8AWzhyxwohQrn/7XO6t4di9cB0uJ6qGBeu+0jBmqLAk+zq8YHxIsmKJmGyRCIXXIogQ5vb9Hi0NiaiVbRBo2iGG9TRNeaREwPsSn6HZHcck5Us2rQmBfIfX4w8OcFHXQizmxcEPZIh68/0jO/ggZgeFuDvSSTGe2suZ1DwklkPDGF9GzXgdkxBWjypYLjgnjoyHgvc63AI4ERYFVBvcJ1NLzxkCPj4RIRH6tZSQLaoViBYKkvhW+KSnKUFQ+wmommaMwL/PMhkLvJG/kHkh5dg==; 31:lGN9KjtrkjGmY1bTHDJWjwqmjTRgJwQ9OhAjUy51O6bnoWOIkCIEvWtPtPyEnkEAa/UKCbP6OSUKUsdVHSv6kodW3sx0wdgk1B/4gxv9jicA2JsdENEhMS+w20B1eB02/3YCGZQ5kyommsUVTWgLqqtu7owTV/P/b5G1Ab6Ub+oKHEJuIt9h/2S+UCPtCPSZGCSfsHIrTDSDM5xaK3iPN4q2SQwBhirsrFrzXLkyPLg= X-MS-TrafficTypeDiagnostic: HE1PR0501MB2011: X-Microsoft-Exchange-Diagnostics: 1; HE1PR0501MB2011; 20:rX1pYMExSjbGwmN2PJfz5mAm79WqMx+smj5TfQ3ywdQovVmXJv+/BZUA+wG6w2xJ/mQtVqfEPDZ9P5sXpm/mq2gtGL4BvflDk5Gg9a80hTcncg9BNUCI8A5DDHfiU6NAki7OOAKpJ4b/M1HpsaixiJv9qQJIM3dANQc87SwEL2TPh4pdlrGNjAyBkxou8aoSO++0uFcbvMKQRVOXXB3SL3fVdcDWqgCFfE4gVtowixZm35paYBMgZpjS8dP83yCap4M+BQDKJmjRrP6MkIbfmVm4zEsTiHzCsLWLHtH+DVHLG6EZSrnZy0qAdxeseKW4e0ff9zkLpZhjQS6guOWEvpOd4YlVA0DrLitJ+AU7x3ZRMpxtADhbA02FLBCahLQZN7ek1mgkeiBzLc/63isxxXtoMs/NKL/lod/dLCS8/qM9fHAQWxYREeynghmobuyA7Gg+/qOUhIw1jpbGm0LgkdwJCczFXFCQwYt3wqFcTuK1F4OgnWhC7IlvK8fgsBRL; 4:p1a5c58JlJuwwscXJYP6GceIMMEN93AjfXyFCGO3NuK7N4RSgZrWIlQGaffyGSmPVXr7LRh35NtrMmtQuycdMfNFRGS/8l6o/DHdgv2rLIDtjsGiOFpey1srjdoxmXGIt2Uw9kF1MTxgbwrv7AXMk7VxrRODF9VNpuFmvmGCIYqi4dmx1v8EvR9ic7N1DGuqArl0yw6c4CbTYLbvykCC9ZV2TSDskhdcMEVEaFdeR5Uw2RFA+XFuEYePyfSwzKpZZl6c0drnPh+6t07xMz+8bEoUo8unArDF4xoqoK0ox4natHBv4568sV0qBOexwCj2 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(228905959029699); X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040470)(2401047)(8121501046)(5005006)(10201501046)(93006095)(93001095)(3002001)(3231023)(6055026)(6041268)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(6072148)(201708071742011); SRVR:HE1PR0501MB2011; BCL:0; PCL:0; RULEID:(100000803101)(100110400095); SRVR:HE1PR0501MB2011; X-Forefront-PRVS: 0527DFA348 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(366004)(39860400002)(39380400002)(396003)(346002)(376002)(199004)(189003)(1076002)(2361001)(53936002)(8676002)(86362001)(6506007)(81166006)(3846002)(16586007)(81156014)(478600001)(59450400001)(16526018)(50466002)(39060400002)(48376002)(230783001)(107886003)(386003)(6116002)(6666003)(2351001)(5660300001)(6916009)(52116002)(97736004)(47776003)(8936002)(36756003)(6486002)(53416004)(2906002)(6512007)(105586002)(316002)(51416003)(66066001)(7736002)(305945005)(25786009)(4326008)(106356001)(50226002)(68736007); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0501MB2011; H:splinter.mtl.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Received-SPF: None (protection.outlook.com: mellanox.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: 1; HE1PR0501MB2011; 23:hpUfbRyoYGgBEtrK4NvYvl7BfLWZRKQOTjV1g46wskMXRUIKv8ZjeC60Ht2bQ3rBYc7C5srK3PaalLr8zQHGsdizBXOOyB1N8pWNxt5yL3X7DwTgKmq4l2KbH1O5RppFUQiSTb7SsZszigOKgSNHivFGI/Kiexe9/aauoWJ0Sbxw208ZqN9YMW2hx21lTaYOEOnIn5S0DV8BSKm0BASp83060yWMsK6gFmQ/QJUYl7aqqrqRzzoVMa9VD+DPAL/isVnoafQiLwQ/iBSz0KMp1PlphiGJdxAy3TJlmtCaTOOVMbsigJnPbIxIQhKNGXh0VNi/jZw/HoPs4jRP8M0n3op1bnolHB65LGZMfJ1O58gFp//lf4dtB6/xU8vu35tQuGJcbXbPEHXxOttrFBAmkkkAgOxS6/4xGnvj8i6nqjljBesl1x4sqO/96zTXf8JgSQrXloKniyWABuHjNlIgOD+u/bMVy4J9fYXimDtAm7dLebHnum0V9Eiqgp35A64bnNA89lmIetk10pLNOJ+93l8j2edUbtcb1gmdw0q0Y77JySRNOUR0nfM2OJxLFudtUdCKtSILyb+EiDUKOjn5nNaw4J6etPlP6Q0UpmiDVmckbT5giO6a+BKPVfAt8DwVNczFaiUDsKCzSqeAMttym/iUzcu1KPF8P77YrdEUxMpr2nsO4H8wnB7AyjO+VqXvpSkMMZ3mdOo7rWoEGtGxokdn1xDo0cbz4+v1PHL9hDMyaY8E2lAII812mt3Y+gs3huZhtt0c7Sxz1PLpoX+eIOHXERU1lt6EDuAarRQkDmgmUtfM1X4aZaaoHoFwdwROCNRj5fQ8UBKjrtV0TQZr+3+ubfUvyd8bZOKPpy+OmD3zHJM+p/pJ3CZCV2bix8nhmFKvFwLTUDV7mJV1jZLJTbhOSR9TY2JcnTH/mThnc1GZdPApDgWYBggTuadyECQ+qZaP328+ufItkMDtKHkJ81vaFwLVKLxfyUCLlCo7qoQuyg9cxe5TEmUcjnYXsLoDSp3EIZDsEUYcHYSPoXn/5Ci5j9hCGU8YdQxQCwWAH6bdKaxG1mlHFuz+8pBQ+ILLJPTtvxpsc0r+h9JtrCgAr/l4La8ysldZS15dFdY+J/dgb4TBqWMtbCgW2n9Qt6YVChhBfcn4NF1+o3sl1cs+jR2m+IzGD9Wvp25fr6/VNrC8RAKAQ434y5qsYn/kZbbb X-Microsoft-Exchange-Diagnostics: 1; HE1PR0501MB2011; 6:Qemw4DVi67UECW98MC8meFZQoclFqYHrdx3Jb+0InbmM1hnCDGZtscTuoeRwK9kVczmZmmwh+ecNF9MZZQZyIOhVdv+qikmXRD/GmwrvmNelqC9m5GyIlUY7/m6lY5Yp4HCLMkIvyY7pESVdHEPcZgkGCbAQGNKc4ry6C9VYEu7LuTgQY9OLn6VCFEpKC4OLPBk2OyWflhx94X1cEZBeRhHyx7TUBWiXLSwRCUODMzQnXWy8KrKkQfhVEi1SMhyAXQoly1QeFw59NRSEFEk10uq7xelvbhNSQSQECCDXZa52grTOdlisjO4W9A7i0xYjXt63lPb2wd9Tn8QJXjLG/eV4OysGBQx1kKMaGNREO28=; 5:DTM988uWuLCZzHZQj5/GdioZS11/yX3MDz21d0eRPxgzz3nBSU6/hu+E0Hcc8a1ocFzrJdwm0IK3rWC/qttr3XN/5PqvYBm/TKoQ+yPno0LJIIM7x6yQjlBkfgykU+n1WEs7KKtUO4NaTZjsWw6NaT/BqYUAtVttbRhj5C+9w1s=; 24:80t6sEaHxWnQe6RfvgqKpwiVMPHXlAgTEP6jaspqsZFtddl+2uTX0+aV1qR70/T4iUiDr1CV+Mktvae/zwfXrX1mK4COzV9kChG4t4mj7nU=; 7:npe72QQyc8qekUZHCR3NfbKRu0pgqUoRc2VmlcuhajPCSlem0Va5DMNn3pLg4mGVzosuIXnoSg/cjfZAUiNiy8SeEUwUFk9KAqy4xJyQT7+RLTM73ni5WgVH8U49Bg2C7s17bpk0i1Qn/JO5bfj/2WA/tAZ9nwuxi/2NwNli5vbt+LDMmRBm6epxZcnWuYZn5gbka5pwRDGcj1+1l0C0z2YGXUkq5QIsm3Q8aGyjGJjJZVTQt0O3nOF1ikMxNOQd SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: Mellanox.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Dec 2017 17:34:40.5210 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 103d56c7-4848-4042-3d52-08d547cff3a0 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: a652971c-7d2e-4d9b-a6a4-d149256f461b X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0501MB2011 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Since commit 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse") the local table uses the same trie allocated for the main table when custom rules are not in use. When a net namespace is dismantled, the main table is flushed and freed (via an RCU callback) before the local table. In case the callback is invoked before the local table is iterated, a use-after-free can occur. Fix this by iterating over the FIB tables in reverse order, so that the main table is always freed after the local table. v3: Reworded comment according to Alex's suggestion. v2: Add a comment to make the fix more explicit per Dave's and Alex's feedback. Fixes: 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse") Signed-off-by: Ido Schimmel Reported-by: Fengguang Wu Acked-by: Alexander Duyck --- net/ipv4/fib_frontend.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c index f52d27a422c3..08259d078b1c 100644 --- a/net/ipv4/fib_frontend.c +++ b/net/ipv4/fib_frontend.c @@ -1298,14 +1298,19 @@ static int __net_init ip_fib_net_init(struct net *net) static void ip_fib_net_exit(struct net *net) { - unsigned int i; + int i; rtnl_lock(); #ifdef CONFIG_IP_MULTIPLE_TABLES RCU_INIT_POINTER(net->ipv4.fib_main, NULL); RCU_INIT_POINTER(net->ipv4.fib_default, NULL); #endif - for (i = 0; i < FIB_TABLE_HASHSZ; i++) { + /* Destroy the tables in reverse order to guarantee that the + * local table, ID 255, is destroyed before the main table, ID + * 254. This is necessary as the local table may contain + * references to data contained in the main table. + */ + for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) { struct hlist_head *head = &net->ipv4.fib_table_hash[i]; struct hlist_node *tmp; struct fib_table *tb;